Disagree. Even bullets shouldn't be displayed while the user types the password. Why should a security camera in an office know that the user's password length is ten, twelve or twenty nine characters?
Stop Password Masking
11–20 of 83 posts
Re: Stop Password Masking
#12The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security
And his solution is to present passwords in clear text?
Hmmm. That seems to be a mix metaphor of a message: lets prompt people to make a more secure password (arguably not going to have much effect) but then display it in clear text.
To me that seems a true loss of security :)
EDIT: ignoring his point (b) because that is completely irrelevant - clear text password boxes are no more or less secure than copy/pasting the password. BUT your not giving the user the choice - every user has that bit less security, not just those copy/pasting.
Re: Stop Password Masking
#13This is very unconventional advise. But this is Jacob Nielsen talking on usability. What he says is generally backed by very extensive testing and way more usability experience than any of us on news.YC have.
You might not agree to unmask all passwords but why not this
> It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even check this box by default.
This is spot on as well.
> Password masking has proven to be a particularly nasty usability problem in our testing of mobile devices, where typing is difficult and typos are common
And on a mobile device, people snooping would be uncommon as well, so why mask passwords on mobile sites?
So please think hard on this, before you dissmiss this as stupid or untenable.
Re: Stop Password Masking
#14Usually this guy's observations are spot on, but this is just wrong. For instance, every time I give a presentation I usually have to login to a secure site. I'm almost always plugged into an overhead projector while I'm logging in. So, not only is this guy suggesting websites change their technology, he's also suggesting users modify their behavior to be more secure. Not going to happen.
> For instance, every time I give a presentation I usually have to login to a secure site.
To be fair, he did suggest that password masking was toggled by a checkbox that was ON by default.
Re: Stop Password Masking
#15Unfortunately usability doesn't necessarily coincide with security. If you have to choose between the two, security always wins.
Re: Stop Password Masking
#16This guy must have been joking. The fact that HE always types his passwords alone in his office does not mean that any sane person would like a possibility that anyone ever has a chance to see his password. Apparently, some people are not always alone...
Yes, good luck to anyone in (a) an open-plan office or (b) an office with security cameras.
or c) at a coffee shop with wi-fi.
Re: Stop Password Masking
#17This is totally ridiculous. So whenever my colleagues or students are working with me on something and I have login to my email or whatever system I need to get to, it's not bad enough that I have to feel uncomfortable that they can see my keyboard while I type my password but they can just look at it on the screen. I guess this is what happens when you actually let "usability experts" design your systems.
As for this "checkbox," how many users will unwittingly have their online identity stolen because regular users aren't thinking about whether they need to select some checkbox before they type in their passsword. Also, that seems more annoying than more usable.
As someone else mentioend, this makes "remember password" totally unworkable; though personally I don't like that feature either.
There is a difficulty in mobile devices but that is because typing on such devices is not really great in terms of usability.
The other thing is that I don't think there is much evidence that this is really a problem. The only "barrier" problem that people have observed is having to create an account in the first place, but that is a separate issue.
Re: Stop Password Masking
#18I'm not willing to concede his point yet, but even if he's right, this should be implemented by the browser, not the website. And if you consider taking his advice, I suggest masking the password as soon as the input field loses focus.
Re: Stop Password Masking
#19I think it would be good if browsers came with an option to mask or don't mask passwords. But I don't know if it would work, since the users who would find and change that option would be the heavy users, that have almost no trouble with passwords. If only that option could be easily showed and asked for simple users: a little icon within password boxes showing if it's masked or not, and a hotkey / click on the icon…
Even if you could make it easy to find such an option, you'd just be giving the users the loaded gun to shoot themselves with.
Re: Stop Password Masking
#20Combine this with the "remember password" feature of most browsers, and you have a real problem.
Browsers have to store the cleantext password and you can see them all here:
Firefox > Preferences > Secutiry > "Saved Passwords" -> "Show Password"